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Claims 




1. A data processing apparatus f^r correlating network events among a number of 
client services comprising: 

at least one computer comprising: 

a memory having program instructions; and 
a processor configured to use/said program instructions to provide: 
a network management service; 
an event notification /service; 
a network mediation service adapted to: 

receive a rav^ event from an external computer network; and 
transmit saic raw event to said event notification service; 
a message parsing service adapted to: 

receive a raA^ event from said event notification service; 
parse said raw event; and 

transmit said parsed event to said event notification service; and 
an event correlation service coupled to a knowledge database comprising 
correlation knowledge, said event correlation service adapted to: 

receive ^id parsed event from said event notification service; 
utilize dlata stored in said knowledge database to derive an event 



from said parsed ev^tfand 
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transmit said derived event to one of a plurality of operator 
workstations via said event notification service; 

wherein said network mediation, message parsing, event 
notification and network management services are coupled together via a plurality of interfaces. 

2. The data processing apparatus of claim 1, wherein said network mediation service 
is adapted to interface with at least one external computer network. 

3. The data processing apparatus of claim 2, wherein said network mediation service 
is further adapted to: 

receive a raw event at said network mediation service from said external computer 

network; and 

transmit said raw event to said message parsing service. 

4. The data processing apparatus of claim 1, wherein said message parsing service is 
adapted to receive a raw event from said network mediation service and produce a parsed event. 



5. The data processing apparatus of claim 4, wherein said message parsing service is 
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adapted to route said parsed event to said network management service via said event notification 
service. 

6. The data processing apparatus of claim 5, wherein said message parsing service is 
adapted to route said parsed event to said event correlation service via said event notification 
service. 

7. The data processing apparatus of claim 1, wherein said network management 
service is adapted to interface with a plurality of operator workstations. 



8. The data processing apparatus of claim 1, wherein said network management 

service is further adapted to: 

receive data requests from said plurality of operator workstations; and 
transmit said data requests to said event correlation service via said event 

notification service. 



9. The data processing apparatus of claim 4, wherein said event notification service 
is further comprised of: 

a raw event channel; 
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a parsed event channel; and 
a derived event channel. 

10. The data processing apparatus of claim 9, wherein said event notification service 
is further comprised of at least one filter. 

11. The data processing apparatus of claim 10, wherein said at least one filter is 
coupled to at least one of said plurality of event channels. 

12. The data processing apparatus of claim 9, wherein said raw event channel is 
adapted to: 

receive a raw event from said network mediation service; and 
transmit said raw event to said message parsing service. 

13. The data processing apparatus of claim 9, wherein said parsed event channel is 
adapted to: 

receive a raw event from said message parsing service; and 
transmit said raw event to said network management service. 



14. 



The data processing apparatus of claim 9, wherein said parsed event channel is 
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adapted to: 

receive a parsed event from said message parsing service; and 
transmit said parsed event to said event correlation service. 

15. The data processing apparatus of claim 9, w^herein said derived event channel is 
adapted to: 

receive a derived event from said event correlation service; and 
transmit said derived event to network management service. 



16. A method for co^elating network event messages on a computer network 
^,,et5mprising a message parsinsservice, an event correlation service, and a knowledge database 
coupled together via a plurality of interfaces, said method comprising the steps of: 
receiving a caw event at said message parsing service; 
5 parsing said raw event by said message parsing service; 

transmitting said parsed event to said event correlation service; 
utilizing data stored in said knowledge database to derive an event from said 
parsed event; and / 

transmitting said derived event to one of a plurality of operator workstations. 
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17. The method of claim 16, wherein said step of transmitting said derived event to 
one of a plurality of operator workstations, further comprising the following steps: 

transmitting said derived event from said event correlation service to a network 
management service; and 

5 transmitting said derived event from said network management service to one of a 

plurality of operator workstations. 



^ JL'^''\^^^- ^ method for correlating network event messages on a computer network 
1[^3 cpffiprising a network mediation service, a message parsing service, an event notification service, 
an event correlation service, arid a knowledge database coupled together via a plurality of 
interfaces, said method comprising the steps of: 
5 receiving a raw event at said network mediation service from an external 

computer network; 

transmittin^said raw event to said message parsing service; 
parsing said raw event by said message parsing service; 
transmitting said parsed event to said event correlation service; 
10 utilizing c|ata stored in said knowledge database to derive an event from said 

parsed event; and 

transmitfting said derived event to one of a plurality of operator workstations. 
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19. The method of claim 18, wherein said step of transmitting said raw event to said 
message parsing service, further comprises the steps of: 

transmitting said raw event from said network mediation service to said event 
notification service; and 

transmitting said raw event from said event notification service to said message 
parsing service. 



20. The method of claim 19, wherein the step of transmitting said raw event from said 
event notification service to said message parsing service, further comprises the following steps: 
receiving said raw event at a raw event channel; 
processing said raw event by said raw event channel; and 
transmitting said raw event from said raw event channel to said message parsing 

service. 



21. The method of claim 20, wherein said step of transmitting said raw event from 
said raw event channel to said message parsing service, further comprises the following steps of: 
transmitting said raw event from said raw event channel to at least one event 

filter; and 
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transmitting said raw event from said at least one event filter to said message 
parsing service. 

22. The method of claim 18, wherein said step of transmitting said parsed event to 
said event correlation service, further comprises the steps of: 

transmitting said parsed event from said message parsing service to said event 
notification service; and 

transmitting said parsed event from said event notification service to said event 
correlation service. 

23. The method of claim 22, wherein the step of transmitting said parsed event from 
said event notification service to said event correlation service, further comprises the following 
steps: 

receiving said parsed event at a parsed event channel; 
processing said parsed event by said parsed event channel; and 
transmitting said processed event from said parsed event channel to said event 
correlation service. 
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24. The method of claim 23, wherein said step of transmitting said processed event 
from said parsed event channel to said event correlation service, further comprises the following 
steps: 

transmitting said processed event from said parsed event channel to at least one 
event filter; and 

transmitting said processed event from said at least one event filter to said event 
correlation service. 

25. The method of claim 18, wherein said step of transmitting said derived event to 
one of a plurality of operator workstations, further comprises the steps of: 

transmitting said derived event from said event correlation service to said event 
notification service; and 

transmitting said derived event from said event notification service to said 
network management service; and 

transmitting said derived event from said network management service to one of a 
plurality of operator workstations. 



26. The method of claim 25, wherein the step of transmitting said derived event from 
said network management service to one of a plurality of operator workstations, further 
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comprises the following steps: 

receiving said derived event at a derived event channel; 
5 processing said derived event by said derived event channel; and 

transmitting said processed event from said derived event channel to said network 
management service. 



□ 



27. The method of claim 26, wherein the step of transmitting said processed event 



\fi from said derived event channel to said network management service, further comprises the 

H 

H following steps: 

□ 

transmitting said processed event from said derived event channel to at least one 

i==; 5 event filter; and 

m 

fll transmitting said processed event from said at least one event filter to said 

Q network management service. 



28. A method for correlating network event messages on a computer network 
\Vncom a network mediation service, a message parsing service, an event notification service, 

tei I I 

ijj aija a network management service coupled together via a plurality of interfaces, said method 

comprising the steps of:j 
5 receiving a raw event at said network mediation service from an external 
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computer network; 

transmitting said raw event to said message parsing service; 
parsing said raw event by said message parsing service; 
transmitting said parsed event to said network management service. 



29. The method of claim 28, wherein said step of transmitting said parsed event to 
said network management service, further comprises the steps of: 

transmitting said parsed event from said message parsing service to said event 
notification service; and 

transmitting said parsed event from said event notification service to said network 
management service. 



30. The method of claim 29, wherein the step of transmitting said parsed event from 
said event notification service to said network management service, further comprises the 
following steps: 

receiving said parsed event at a parsed event channel; 
processing said parsed event by said parsed event channel; and 
transmitting said processed event from said parsed event channel to said network 
management service. 
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31. The method of claim 30, wherein said step of transmitting said processed event 
from said parsed event channel to said network management service, further comprises the 
following steps of: 

transmitting said processed event from said parsed event channel to at least one 
5 event filter; and 

transmitting said processed event from said at least one event filter to said 
network management service. 



Sot 




A data processmg apparatus for correlating network events among a number of 
|^^cli€nt services comprising: 

means for deceiving a raw event at said message parsing service; 
means for parsing said raw event by said message parsing service; 
5 mcmi for transmitting said parsed event to said event correlation service; 

means for utilizing data stored in said knowledge database to derive an event from 
said parsed event; and 

means for transmitting said derived event to one of a plurality of operator 

workstatjbns. 
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33. A computer system for correlating network events among a number of client 
services comprising: / 

a memory having program instructions; and 

a processor configured to use the program instructions to receive a raw event at said 
network mediation service from an external computer network; to transmit said raw event to said 
message parsing service; to parse said raw event by said message parsing service; to transmit said 
parsed event to said event correlation service; to utilize data stored in said knowledge database to 
derive an event from said parsed event; and to transmit said derived event to one of a plurality of 
operator workstations. 



44 



